A raw string path concatenation flaw in pygeoapi's STAC FileSystemProvider allows attackers to construct URLs containing directory traversal sequences, which the server passes through unfiltered to the underlying file system. This can expose configuration files, data sets, or other sensitive information in directories that should be inaccessible, thereby compromising confidentiality with no authentication required. The vulnerability correlates with CWE‑22, Path Traversal.

The issue affects geopython's pygeoapi product, specifically versions from 0.23.0 up to but not including 0.23.3. Users running any of those releases with the STAC FileSystemProvider enabled and a stac-collection resource defined in the configuration are impacted.

The CVSS score of 7.5 indicates a high severity, and while an EPSS score is not available, the exploitability is likely moderate due to the need for a configured STAC endpoint and deployment without a defensive proxy or URL normalizer. The vulnerability is not listed in CISA's KEV catalog, suggesting no documented public exploits yet, but the lack of authentication and the simplicity of the attack path make it attractive to adversaries. The attack vector is network-based, requiring the ability to send crafted HTTP requests to the vulnerable pygeoapi instance.